How to Find MFA Bypasses in Conditional Access Policies

Conditional access policies allow organizations to create fine-grained controls over how MFA is applied during authentication to Microsoft services such as Microsoft 365 and Azure. Occasionally, configurations are made that enable single factor access in certain scenarios. As an external attacker who compromises a credential it may be possible to discover these MFA inconsistencies. As an organization managing conditional access policies each one should be checked regularly to ensure loopholes aren't being unintentionally created. This video demonstrates tools that can be used to find potential single factor access conditions in conditional access policies.
Links:
What are Conditional Access Policies? learn.microsoft.com/en-us/azu...
MFASweep: github.com/dafthack/MFASweep
ROADTools: github.com/dirkjanm/ROADtools
Breaching the Cloud Training: www.antisyphontraining.com/br...

[@michaelwaterman3553]

Wow, this is great info! Going to share with my team on Monday. Big thanks!

[@meazer]

great video. very well-condensed and no needless tangents. so many other people would've made this video 30 mins long. this is perfect, keep it up.

[@PaulLinger]

This is a great video. Appreciate you creating the tool, will def be leveraging tomorrow morning lol.

[@melonscratcher]

Hey Beau - Great video! First time I watched your content and I do like it a lot! Skills to pay the bills, keep it rolling. SUBSCRIBED !!!

[@cgaz9088]

Great video, great tool, a great addition to my toolbox! Thanks for the hard work

[@jmedoestech]

Very informative video. I'm 100% going to be replicating this / testing a couple of scenarios myself. Thank you for sharing this knowledge 👍 Keep up the good work!

[@owensben]

Very well presented and straight to points with demos, nice work! Shows the importance of a policy which blocks access all operating systems but allows connections from operating systems which you supported, such as iOS, Android, Windows and MacOS. Like the tools you showed and thanks for sharing. Subscribed.

[@michaelrogers2011]

Solid breakdown, thanks Beau.

[@SumanRoy.official]

Wonderful video, totally an uncommon topic , subbed

[@user-ty3iy8bk2l]

Amazing video. Exactly what I was looking for. Subbed

[@LukePWilkinsVids]

Brilliant information! Thank you

[@prisa1590]

Very interesting! Nice video.

[@patrick__007]

A great video. Thanks voor sharing.

[@user-eu2yf6ij2t]

Yeah, I'm gonna need nobandwidth intro music bro ;)

[@nattsvart199]

Great video. Please do more mfa hacking and protecting.

[@australiansango]

Great video.

[@MichaelToub]

Great Video!!

[@eslamkamal1704]

Great content as usual 👏👏 what is the best way to perform OPSEC during Azure Pentesting for example!!

[@GisselleGuzman-pk8ui]

hehehhe it's WORKING!! :) THANKS!! for creating this powershell script ..liked and subscribed

[@anonymous-zi1pw]

hi can you help me authenticate my account?

[@vicariousphoto]

Spreadin them sheets 😎

[@MrJoeyverlinden]

Can't find the device emulation mode in my (fully patched) Edge browser. How did you open it? 🤔

[@hullan666]

Hi! I have built some CA policies that I'm pretty sure are watertight but just wanted to check with this script. However, I get a "Login appears to have failed" on almost all the logins? The Graph API and the Azure mgmt API are the two only ones that give me the green text with "the response indicates MFA is in use"

[@ajmaddox1540]

Beau - the account that was 'compromised' for your example and that you utilized to do your MFA sweep -- was it elevated at all? any admin permission roles?

[@pelicansurfs]

Curious about this as well

[@swarajshubham007]

I want to bypass MFA under trusted IP network. Set conditional access policy and added my IP as trusted ip still facing the MFA prompt.

[@Zachsnotboard]

so if you were to use -UsersPermissionToReadOtherUsersEnabled FALSE , would this keep tools like MFA sweep from getting this info ?

[@patrick__007]

Can you do this in bulk? Instead per user per group per instance

[@socbrian]

Thanks for the video and tool. What if the company uses a federation service like Ping/Okta, I assume your tool wouldn't support that as the fields to stuff username / password would be different than MS's login screens

[@wunderwuzzi3113]

Common misconfig includes ROPC working (e.g. MFA enforced at identity provider, but not in AAD) - so ROPC attack works and AAD gives out access token.

[@anonymous-zi1pw]

hi bro, did you get how to authenticate mfa? i need help

[@BVey-tt6wl]

What privileges did the (breached) account hold?

[@Boolap1337]

Cool

[@nmelanson75]

Does not work for me for Import I get a The ampersand (&) character is not allowed.

[@arjanvanveen3312]

Is there a way to bypass my antivirus? This script contains malicious content and has been blocked by your antivirus software.

[@lewiskelly14]

The title should be clearer that this is for cloud and doesn't apply to Windows Server

[@jackl8499]

Cool